Ivanti · Pulse Connect Secure
CVE-2021-22893
Ivanti Pulse Connect Secure Use-After-Free Vulnerability
What it is
Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windows File Share Browser and Pulse Secure Collaboration features of Pulse Connect Secure that can allow an unauthenticated user to perform remote arbitrary code execution on the Pulse Connect Secure gateway. This vulnerability has been exploited in the wild.
CISA: Ivanti Pulse Connect Secure contains a use-after-free vulnerability that allow a remote, unauthenticated attacker to execute code via license services.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
More exploited flaws from Ivanti
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Nov 3, 2021 | Code Execution | Pulse Connect Secure | High 7.2 | 91% |
| Nov 3, 2021 | Code Execution | Pulse Connect Secure | High 7.2 | 96% |
| Nov 3, 2021 | Arbitrary File Read | Pulse Connect Secure | Critical 9.9 | >99.9% |
| Nov 3, 2021 | Collaboration Suite Buffer Overflow | Pulse Connect Secure | High 8.8 | 41% |
| Nov 3, 2021 | Command Injection | Pulse Connect Secure | High 8.8 | 23% |
| Nov 3, 2021 | Unrestricted File Upload | Pulse Connect Secure | High 7.2 | 14% |
| Oct 13, 2026 | Authentication Bypass by Spoofing | Connect Secure | High 8.6 | 87% |
| Jun 11, 2026 | OS Command Injection | Sentry | Critical 10.0 | 99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.